Create more efficient "IF"statement that looks at the last 30 days

[UMDTERPS]

| eval nessus = if(like(nessus, "%2019") AND relative_time(now(), "-30d@d") < strptime(nessus,"%m/%d/%Y"), 1, 0)

Above is my current IF statement I use on a daily report. The IF statement looks at the nessus field that has time, checks for 2019 (but within 30days), and gives the the field nessus a 1 if it finds a date less than 30 days (or 0 when it's more than 30 days). BUT the only problem is it only looks at 2019. I can change it to 2020, but the scan results will be zero because there won't be any scans immediately in 2020 (tomorrow). Many of my current dashboard panels will be blank tomorrow if I change it to 2020.

Is there a way to change my IF statement SPL from "2019" to something I don't have to keep changing at the end of the year? (something that will look at 2019, 2020, 2021, etc)

Thanks!

[richgalloway · Accepted solution]

If you're only interested in the last 30 days, why check the year at all?

| eval nessus = if(strptime(nessus, "%m/%d/%y") > relative_time(now(), "-30d@d"), 1, 0)

[UMDTERPS]

That works! Thanks! =0)

I see that strptime returns NULL for all malformed values. NULL compared to any number returns false from your eval statement. That's why we used the "If(like)" statement, because we were not sure.